An intrusion detection system (IDS) is typically used for the purpose of detecting unwanted manipulations of computer systems. Such unwanted manipulations may take the form of malicious network traffic and computer usage that cannot be detected by a conventional firewall. Some examples of unwanted manipulations include network attacks against vulnerable services, data-driven attacks on applications, host-based attacks such as privilege escalation, unauthorized logins and access to sensitive files, and so-called malware (viruses, Trojan horses, and worms).
One of the obstacles that may be encountered when attempting to perform high-speed intrusion detection is a problem associated with the need to detect an attack signature that may be split across several data packets. In order to detect such attacks, some existing systems require transmission control protocol (TCP) reassembly and/or normalization, which, in turn, may require storing of a significant amount of per-TCP-connection state in order to identify attack signatures that may be split across multiple data packets. Furthermore, as a server may be capable of maintaining as many as one million connections, and as an average of 100 bytes or more may need to be stored for each connection, the total memory requirement for such an intrusion detection system may create a need for an off-chip dynamic random access memory (DRAM) and a processor complex, which may be less than desirable.